Archive

Search formatting in Splunk 6.5.0 for easier readability

Path Finder

I saw a feature in Splunk 6.5.0 where you can press a single button in the search bar and it will autoformat the query so it's far easier to read. Does anyone know what this shortcut is?

Tags (2)
1 Solution

Contributor

I believe it is Ctrl+\ or Cmd+\

View solution in original post

Path Finder

The answer that worked for me is kinda buried, so I'll repeat it here. 1password has cmd + \so it moved tocmd + fn + ``

0 Karma

Path Finder

Issue resolved for me when I learnt that under Splunk user profile's Preferences > Chose SPL Editor > Enable "Advanced editor". You can also enable "Line numbers" and "Search auto-format"

0 Karma

New Member

Ctrl + | (Ctrl + pipe) Worked for me on Windows 7, Splunk version 6.x and 7.x,Ctrl + | (Ctrl + pipe) worked for me on Windows 7

0 Karma

Path Finder

ok... again as an answer...

Just checked on Firefox, Windows 10, German keyboard:
Ctrl (Strg) + Shift + F
This should work with nearly all keyboard layouts...

Have fun 😉

Explorer

Yep thanks, it does the trick.

0 Karma

Engager

Ctrl+\ its perfectly working in Windows

0 Karma

Splunk Employee
Splunk Employee

Cmd+\ works perfectly on Mac

0 Karma

Builder

On my "new" OSX 10.14.4 Cmd+\ doesn't work anymore. Ideas?!?

Marco

0 Karma

Splunk Employee
Splunk Employee

what happens? In my case 1password owns the cmd + \ so it moves to fn + cmd + \ . Try that, or turn on auto-format under user prefs. User > prefs > spl editor, as someone mentioned below.

Contributor

I believe it is Ctrl+\ or Cmd+\

View solution in original post

New Member

Ctrl + \ doesn't work for me.

I'm on Windows 10 withe splunk enterprise 7.1.1 and on chrome

,ctrl + \ doesnt work on windows for me. I'm on splunk 7.1.1

0 Karma

Path Finder

Windows 10, with Splunk Enterprise Version: 7.1.5 Build: fd4da3d4caf1. Tried with Firefox, Chrome, ctrl + \ does not work for me anymore. Was working on 7.0.3

0 Karma

Path Finder

Thank you, Ctrl + \ is exactly what I was talking about.

0 Karma

Explorer

I have a spanish keyboard, I don't have the "\" key, is there any shortcut for me?

0 Karma

Splunk Employee
Splunk Employee

There are two defects filed about non-English keyboards and the search formatting: SPL-130405 and SPL-135260. In an upcoming release, there will be an enhancement so that you can use Command-shift-f.

Can you get a backslash by typing Ctrl + alt + "º ª \" (the first key to the left of " 1 ! | " )?

0 Karma

Splunk Employee
Splunk Employee

also be aware (at least on MAC) that browser plugins like 1password etc, may step on the shortcut, so it become fn + cmd + \\

0 Karma

Splunk Employee
Splunk Employee

Documented in Help reading searches in the Search Manual.